Write a scope a stranger could execute

short · 45 min · Objective 1.1

Task

Turn a one-line client goal into a scope document precise enough that a colleague who has never spoken to the client could pick it up and know exactly what they may touch — including, especially, what they may not.

Steps

  1. Take this goal: "We want to know if an attacker could reach our customer database." Write /tmp/scope.md.
  2. Write the in-scope section as enumerable facts: address ranges in CIDR, fully-qualified names, named applications and environments, and the accounts provided. Invent concrete lab values — this is a drill in precision.
  3. Write the out-of-scope section, and make it name things a reasonable tester might otherwise assume were fair game: a third-party-hosted asset, a production database during business hours, a sibling company's domain.
  4. Add a windows section: the testing window, any blackout period, and two emergency contacts.
  5. Add a one-line ambiguity rule: what you do when a target's status is unclear mid-test. The default is stop and ask.
  6. For every in-scope name, add a note that its address must be resolved and ownership confirmed before testing — because a name is not a target.

Verify

grep -cE "^##\s+(In scope|Out of scope|Windows|Ambiguity)" /tmp/scope.md
grep -cE "([0-9]{1,3}\.){3}[0-9]{1,3}(/[0-9]{1,2})?" /tmp/scope.md
grep -ciE "stop and ask|confirm|resolve.*ownership" /tmp/scope.md

The first count must be 4 — all four required sections present. The second must be non-zero: an in-scope section with no concrete addresses is a wish, not a scope. The third must be non-zero: the ambiguity rule and the ownership check are what stop a scope from silently expanding.

Notes

The out-of-scope section is the one people skip and the one that protects both sides. A scope that needs you in the room to interpret is not finished — the test of a good one is exactly the stranger in the task line. This document is the input the applied lab turns into a full rules-of-engagement package.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.